Merge pull request #7594 from nimish/update-helmet

Update helmet CSP typings

helmet/helmet-tests.ts

@@ -15,11 +15,45 @@ function helmetTest() {
 /**
  * @summary Test for {@see helmet#xssFilter} function.
  */
-function contentSecurityPolicyTest() {
+function xssFilterTest() {
     app.use(helmet.xssFilter());
     app.use(helmet.xssFilter({ setOnOldIE: true }));
 }
 
+/**
+ * @summary Test for {@see helmet#csp} function
+ */
+
+function contentSecurityPolicyTest() {
+    
+    // taken directly from helmet-csp docs
+    const config = {
+        // Specify directives as normal.
+        directives: {
+            defaultSrc: ["'self'", 'default.com'],
+            scriptSrc: ["'self'", "'unsafe-inline'"],
+            styleSrc: ['style.com'],
+            imgSrc: ['img.com', 'data:'],
+            sandbox: ['allow-forms', 'allow-scripts'],
+            reportUri: '/report-violation',
+
+            objectSrc: ["'self'"], // An empty array allows nothing through
+        },
+
+        // Set to true if you only want browsers to report errors, not block them
+        reportOnly: false,
+
+        // Set to true if you want to blindly set all headers: Content-Security-Policy,
+        // X-WebKit-CSP, and X-Content-Security-Policy.
+        setAllHeaders: false,
+
+        // Set to true if you want to disable CSP on Android where it can be buggy.
+        disableAndroid: false
+    }
+    app.use(helmet.csp());
+    app.use(helmet.contentSecurityPolicy(config));
+}
+
 /**
  * @summary Test for {@see helmet#frameguard} function.
  */

helmet/helmet.d.ts

@@ -7,7 +7,24 @@
 
 declare module "helmet" {
     import express = require("express");
-
+    
+    interface IHelmetCspDirectives {
+        defaultSrc? : string[];
+        scriptSrc? : string[];
+        styleSrc? : string[];
+        imgSrc? : string[];
+        sandbox? : string[];
+        reportUri? : string;
+        objectSrc? : string[];
+    }
+    
+    interface IHelmetCspConfiguration {
+        reportOnly? : boolean;
+        setAllHeaders? : boolean;
+        disableAndroid? : boolean;
+        directives? : IHelmetCspDirectives
+    }
+    
     /**
      * @summary Interface for helmet class.
      * @interface
@@ -70,6 +87,19 @@ declare module "helmet" {
          * @param {Object} options The options.
          */
         xssFilter(options ?: Object):express.RequestHandler;
+
+        /**
+         * @summary Set policy around third-party content via headers
+         * @return {RequestHandler} The Request handler
+         * @param {Object} options The options
+         */
+        csp(options ?: IHelmetCspConfiguration): express.RequestHandler;
+
+        /**
+         * @see csp
+         */
+        contentSecurityPolicy(options ?: IHelmetCspConfiguration): express.RequestHandler;
+
     }
 
     var helmet: Helmet;